Cloudanix VulnDB

CVE-2026-90309

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux RDMA networking code can let a local user crash the system or take full control by exploiting a timing issue during queue cleanup.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the erdma RDMA driver where EQ event handlers can dereference a CQ object after erdma_destroy_cq has removed it from the xarray and freed its resources, because no reference count was held outside the xarray lock.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes, memory corruption, or arbitrary code execution, leading to system downtime or full host compromise on servers using the erdma RDMA device.

How an attack unfolds

An attacker with local access creates and destroys completion queues in rapid succession while EQ events are being processed; the race allows the handler to invoke callbacks on a freed CQ structure, resulting in use-after-free.

How to fix it

Upgrade the Linux kernel to a version containing the reference-count fix for RDMA/erdma CQ handling. Reboot systems after the update and verify the erdma module is loaded only when required.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds CQ refcount_inc_not_zero under the xarray lock and removes the CQ before dropping the destroy-path reference; test by exercising CQ creation/destruction under load.

Typical attack path

  1. Obtain local unprivileged access to a system with erdma hardware or emulation enabled
  2. Repeatedly allocate and destroy CQs while generating EQ events
  3. Trigger the race window between xarray removal and completion of in-flight EQ handlers
  4. Exploit the resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel logs for oops or use-after-free warnings involving erdma and CQ structures; correlate with process activity that rapidly creates and destroys completion queues.

What your security team should do

  • Apply the kernel update containing the CQ reference-count fix as soon as it is available in your distribution
  • Disable the erdma driver via modprobe.blacklist if RDMA is not required
  • Monitor for local privilege-escalation attempts on systems exposing RDMA interfaces
  • Include the updated kernel in the next maintenance window for all affected hosts

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or error callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ from the xarray and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using the CQ. Add a CQ refcount and take a reference under the xarray lock with refcount_inc_not_zero(). Remove the CQ from the xarray before dropping the destroy-path reference, then wait for in-flight EQ users before releasing CQ resources.

Affected packages

Ecosystem Package Introduced Fixed